Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2007-3825: Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly

57
This week
HIGH 9.3MITIGATEDOWNGRADEDOWNGRADE

CVE-2007-3825 is a high-severity flaw (CVSS 9.3) affecting alert notification server, brightstor arcserve backup, brightstor enterprise backup. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly Computer Associates) Alert Notification Server, as used in Threat Manager for the Enterprise, Protection Suites, certain BrightStor ARCserve products, and BrightStor Enterprise Backup, allow remote attackers to execute arbitrary code by sending certain data to unspecified RPC procedures.

Why this priority

  • Critical severity
  • EPSS top 3%: very likely to be exploited

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score9.3 (High)
EPSS exploit chance14.0% (top 3%)
CISA exploited listNo
Published2007-07-18
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: broadcom · ca

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

broadcom alert notification server MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy alert-notification-server || rpm -q alert-notification-server || alert-notification-server --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
broadcom brightstor arcserve backup DOWNGRADE
Affected: 9.01 · 11.1 · 11.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.01
1. Check installed version
apt-cache policy brightstor-arcserve-backup || rpm -q brightstor-arcserve-backup || brightstor-arcserve-backup --version
2. No fixed release: DOWNGRADE to a release before 9.01 (Debian / Ubuntu)
apt-cache madison brightstor-arcserve-backup sudo apt install brightstor-arcserve-backup=<VERSION_BEFORE_9.01> sudo apt-mark hold brightstor-arcserve-backup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-arcserve-backup sudo dnf downgrade brightstor-arcserve-backup-<VERSION_BEFORE_9.01> sudo dnf versionlock add brightstor-arcserve-backup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom brightstor enterprise backup DOWNGRADE
Affected: 10.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.5
1. Check installed version
apt-cache policy brightstor-enterprise-backup || rpm -q brightstor-enterprise-backup || brightstor-enterprise-backup --version
2. No fixed release: DOWNGRADE to a release before 10.5 (Debian / Ubuntu)
apt-cache madison brightstor-enterprise-backup sudo apt install brightstor-enterprise-backup=<VERSION_BEFORE_10.5> sudo apt-mark hold brightstor-enterprise-backup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-enterprise-backup sudo dnf downgrade brightstor-enterprise-backup-<VERSION_BEFORE_10.5> sudo dnf versionlock add brightstor-enterprise-backup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ca anti-virus for the enterprise DOWNGRADE
Affected: 8
Fixed in: no fixed release known
Safe to downgrade to: a release before 8
1. Check installed version
apt-cache policy anti-virus-for-the-enterprise || rpm -q anti-virus-for-the-enterprise || anti-virus-for-the-enterprise --version
2. No fixed release: DOWNGRADE to a release before 8 (Debian / Ubuntu)
apt-cache madison anti-virus-for-the-enterprise sudo apt install anti-virus-for-the-enterprise=<VERSION_BEFORE_8> sudo apt-mark hold anti-virus-for-the-enterprise
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list anti-virus-for-the-enterprise sudo dnf downgrade anti-virus-for-the-enterprise-<VERSION_BEFORE_8> sudo dnf versionlock add anti-virus-for-the-enterprise
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ca brightstor arcserve backup DOWNGRADE
Affected: 11
Fixed in: no fixed release known
Safe to downgrade to: a release before 11
1. Check installed version
apt-cache policy brightstor-arcserve-backup || rpm -q brightstor-arcserve-backup || brightstor-arcserve-backup --version
2. No fixed release: DOWNGRADE to a release before 11 (Debian / Ubuntu)
apt-cache madison brightstor-arcserve-backup sudo apt install brightstor-arcserve-backup=<VERSION_BEFORE_11> sudo apt-mark hold brightstor-arcserve-backup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-arcserve-backup sudo dnf downgrade brightstor-arcserve-backup-<VERSION_BEFORE_11> sudo dnf versionlock add brightstor-arcserve-backup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ca brightstor arcserve client MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy brightstor-arcserve-client || rpm -q brightstor-arcserve-client || brightstor-arcserve-client --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-3825?

alert notification server: mitigate or apply the listed mitigation; brightstor arcserve backup: downgrade or apply the listed mitigation; brightstor enterprise backup: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-3825 being exploited?

CVE-2007-3825 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-3825 affect?

CVE-2007-3825 affects alert notification server, brightstor arcserve backup, brightstor enterprise backup. Severity is high (CVSS 9.3). Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly Computer Associates) Alert Notification Server, as used in Threat Manager for the Enterprise, Protection Suites, certain BrightSto

How urgent is CVE-2007-3825?

Priority 57/100. Critical severity; EPSS top 3%: very likely to be exploited

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.